The system-specific policy provides guidance around how a specific information system should be operated and maintained. System-specific policies are needed if a specific information system requires additional policies and guidance above and beyond what the organizational policies cover:
